General

  • Target

    citizen.exe

  • Size

    231KB

  • Sample

    241222-x23ggawnbv

  • MD5

    8fcef0c1c33c1f00b585f79e484a63fa

  • SHA1

    57eaedd0de6fc7b965a6b132cf23380076e63336

  • SHA256

    dc2a8b1f1aec321b087018c6177a9a6478d3ee10b04ef0ed525e3b33206ea3fc

  • SHA512

    ab422374c0f26ce2834b3738d7c4611f214ebb7090f98b7aa92bc1a7a273ead93186013268b5c15878f0df9c075c870ff9648001efc3f9ec03951d83df820fb0

  • SSDEEP

    6144:RloZM+rIkd8g+EtXHkv/iD42i6kgGhZqLfiQBFUAjb8e1mAi:joZtL+EP82i6kgGhZqLfiQBFU+e

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1320454676080103465/W6LdShCFhm1tqQOZ7F78sDgYM-wcYax6bTcou8_CxzWljm8rXr7REB-KdFUQR_9zggA7

Targets

    • Target

      citizen.exe

    • Size

      231KB

    • MD5

      8fcef0c1c33c1f00b585f79e484a63fa

    • SHA1

      57eaedd0de6fc7b965a6b132cf23380076e63336

    • SHA256

      dc2a8b1f1aec321b087018c6177a9a6478d3ee10b04ef0ed525e3b33206ea3fc

    • SHA512

      ab422374c0f26ce2834b3738d7c4611f214ebb7090f98b7aa92bc1a7a273ead93186013268b5c15878f0df9c075c870ff9648001efc3f9ec03951d83df820fb0

    • SSDEEP

      6144:RloZM+rIkd8g+EtXHkv/iD42i6kgGhZqLfiQBFUAjb8e1mAi:joZtL+EP82i6kgGhZqLfiQBFU+e

    • Detect Umbral payload

    • Umbral

      Umbral stealer is an opensource moduler stealer written in C#.

    • Umbral family

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Drops file in Drivers directory

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks